Add renewal failure notifications

[nullcert]

Operator problem: MVP exposes the latest redacted result in the authenticated interface but does not send outbound notifications. Proposed outcome: constrained notification integrations that report health and reason codes without leaking provider credentials, account material, certificate keys, or unbounded command output. A design must define delivery retries, secret storage, duplicate suppression, and what happens when the notification channel itself fails. Vote with one positive reaction and comment with the integration you actually operate.